<div dir="ltr">Syed,<div><br></div><div>In order for a NameID to be released, you need to have the attribute available(which it probably is), it needs to be a candidate for a NameID for this relying party(which it probably isn't), and it needs to be the one that is chosen in any given transaction.</div><div><br></div><div><a href="https://wiki.shibboleth.net/confluence/display/IDP30/NameIDGenerationConfiguration">https://wiki.shibboleth.net/confluence/display/IDP30/NameIDGenerationConfiguration</a><br></div><div><br></div><div>In this case, you're adding a nameFormat to an attribute. They're looking for a NameID, which is totally different. You'll want to revert to the default URI nameFormat for the attribute.</div><div><br></div><div><a href="https://wiki.shibboleth.net/confluence/display/CONCEPT/NameIdentifiers">https://wiki.shibboleth.net/confluence/display/CONCEPT/NameIdentifiers</a><br></div><div><br></div><div>Also remember that relying-party.xml operates on a first-match, first-serve basis. You might have an entry without an activationCondition further up in your file that is superceding other configuration.</div><div><br></div><div>Take care,</div><div>Nate.</div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Aug 1, 2018 at 10:56 AM, sshabbir <span dir="ltr"><<a href="mailto:sshabbir@bmj.com" target="_blank">sshabbir@bmj.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hello,<br>
<br>
In trying to comply with our SP request to sign assertions, and not encrypt<br>
them, I've added below to /relying-party.xml/<br>
<br>
<bean parent="RelyingPartyByName"<br>
c:relyingPartyIds="https://...<wbr>./samlLogin"><br>
<property name="profileConfigurations"><br>
<list><br>
<bean parent="SAML2.SSO"<br>
p:encryptAssertions="false" p:signAssertions="true"<br>
p:encryptNameIDs="false"/><br>
<br>
However, the SAML response extract below suggests this does not seem to work<br>
<br>
/<saml2:NameID Format="urn:oasis:names:tc:<wbr>SAML:2.0:nameid-format:<wbr>transient"<br>
NameQualifier="https://.../<wbr>idp/shibboleth"<br>
SPNameQualifier="https://.../<wbr>samlLogin"><br>
*<wbr>AAdzZWNyZXQxhqCyvp0AoTAcLu2yR5<wbr>BufFgIHiwkFNHRH18y0F7E73EhUzyo<wbr>S2FrWS1fjRCHngAAQgAeQdnzI0XCt0<wbr>80OG72GaeXGJlywVBn6+Z2o/<wbr>xw7jPVuqsYSmhOuMi1bUzUNHYrQ6GQ<wbr>n5/<wbr>NAk6VrhlU4IVQgOIzpHvGdsHhbKVkG<wbr>4mJBUiZd6UuVOYLqUnckY/<wbr>pjz3QZCQh6CPrrxnAZ2QVQw==*<br>
</saml2:NameID>/<br>
<br>
<br>
They are also adamant that <br>
<br>
/NameID Format must either be not provided, or<br>
“urn:oasis:names:tc:SAML:1.1:<wbr>nameid-format:unspecified”, or<br>
“urn:oasis:names:tc:SAML:2.0:<wbr>nameid-format:unspecified”/<br>
<br>
Based on<br>
<a href="https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/<wbr>confluence/display/IDP30/<wbr>CustomNameIDGenerationConfigur<wbr>ation</a>, <br>
adding the attribute<br>
p:nameIDFormatPrecedence="urn:<wbr>oasis:names:tc:SAML:1.1:<wbr>nameid-format:unspecified"<br>
to the SAML2.SSO bean, under "RelyingPartyByName", results in a response<br>
with no saml2:NameID entry. <br>
<br>
In fact, I can only get that entry to appear by updating the<br>
attribute-resolver entry as below<br>
<br>
<AttributeDefinition xsi:type="Simple" id="UserName"<br>
sourceAttributeID="userName"><br>
<Dependency ref="<wbr>scriptedAttributeConnector" /><br>
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.42"<br>
nameFormat="urn:oasis:names:<wbr>tc:SAML:1.1:nameid-format:<wbr>unspecified"<br>
encodeType="false" /><br>
<br>
</AttributeDefinition><br>
<br>
Thanks in advance...<br>
<br>
<br>
<br>
<br>
-----<br>
Syed<br>
--<br>
Sent from: <a href="http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html" rel="noreferrer" target="_blank">http://shibboleth.1660669.n2.<wbr>nabble.com/Shibboleth-Users-<wbr>f1660767.html</a><br>
<span class="HOEnZb"><font color="#888888">-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/<wbr>confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a></font></span></blockquote></div><br></div></div>